Igor Glucksmann

**Name of the Vulnerable Software and Affected Versions** Windows Server 2012 R2 Windows RT 8.1 Windows Server 2012 Windows Server 2019 Windows Server 2016 Windows 8.1 Windows 10 Windows 10 Servers **Description** A security feature bypass exists due to incorrect validation of kernel driver signatures by Windows. This issue is related to errors in the kernel driver authentication mechanism, which can allow an attacker to load incorrectly signed drivers into the kernel. **Recommendations** For Windows Server 2012 R2, update the operating system to a version that includes the security patch for this issue. For Windows RT 8.1, apply the recommended configuration changes to mitigate the risk of exploitation. For Windows Server 2012, consider disabling the loading of kernel drivers until a patch is available. For Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, and Windows 10 Servers, apply the necessary security updates to resolve the issue. As a temporary workaround, consider restricting access to the kernel driver loading mechanism to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview **Description** The Authenticode Signature Verification function in Microsoft Windows does not properly validate the digest of a signed portable executable (PE) file. This allows user-assisted remote attackers to execute arbitrary code via a modified file with additional content. An attacker could exploit the vulnerability by modifying an existing signed executable file to add malicious code without invalidating the signature, potentially taking complete control of an affected system. **Recommendations** For Microsoft Windows XP SP2 and SP3, consider applying security updates or patches to fix the Authenticode Signature Verification issue. For Windows Server 2003 SP2, apply the recommended security patch to resolve the vulnerability. For Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview, update to a newer version or apply the relevant security fix to mitigate the risk of exploitation. As a temporary workaround, consider restricting the execution of signed portable executable (PE) files until a patch is available.